mediumMultiple ChoiceObjective-mapped
CISA Practice Question: Based on the exhibit, what is the most likely…
Exhibit
Refer to the exhibit. Audit Finding Report Excerpt: Finding ID: F-001 Control: User Account Management Observation: Review of Active Directory logs from 01-Mar-2024 to 07-Mar-2024 revealed that the default administrator account (Administrator) was used to perform 45% of all privileged actions. No evidence of secondary approval or time-based restrictions. Configuration snippet from domain controller: Set-ADUser -Identity Administrator -PasswordNeverExpires $true Set-ADUser -Identity Administrator -CannotChangePassword $true Audit Recommendation: Implement a privileged access management (PAM) solution and enforce use of individual privileged accounts.
Based on the exhibit, what is the most likely control weakness that allowed this condition?
⚠ Common exam trap
Many exam-takers confuse 'shared accounts' with 'default accounts' (Option C) or 'weak passwords' (Option A), but the exhibit's key indicator is multiple users logging in with the same non-default privileged account, which directly points to a lack of individual accountability.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Lack of individual accountability for privileged actions
The exhibit shows that multiple users are sharing a single privileged account (e.g., 'root' or 'admin') to perform administrative actions. Without unique user IDs for each administrator, it is impossible to map specific actions (e.g., a 'sudo' command or a configuration change) back to an individual. This lack of individual accountability is the core control weakness, as it violates the audit principle of non-repudiation and prevents effective forensic investigation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Weak password complexity requirements
Why it's wrong here
Incorrect: The finding shows PasswordNeverExpires, but complexity is not mentioned; the core issue is shared use.
- ✓
Lack of individual accountability for privileged actions
Why this is correct
Correct: Using a shared default account prevents attribution of actions to individuals.
- ✗
Failure to disable the default administrator account
Why it's wrong here
Incorrect: Disabling the account is not required; the issue is shared use without controls.
- ✗
Inadequate segregation of duties between IT and security teams
Why it's wrong here
Incorrect: The finding does not address segregation of duties between teams.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 995 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.